resourceloader: Give module eval the ContentSecurityPolicy nonce